package poc

import (
	"github.com/fatih/color"
	"ssp/common"
	"strings"
)

func CVE_2018_1273(url string, proxyURL string) {
	headers := map[string]string{
		"User-Agent":   common.GetRandomUserAgent(),
		"Content-Type": "application/x-www-form-urlencoded",
	}

	path1 := "users"
	path2 := "users?page=0&size=5"

	tryPaths := []string{path1, path2}

	for _, path := range tryPaths {
		testURL := url + path

		resp, body, err := common.MakeRequest(testURL, "GET", proxyURL, headers, "")
		if err != nil {
			color.Yellow("[-] %s 请求失败，跳过漏洞检查\n", url)
			continue
		}

		if resp.StatusCode == 200 && strings.Contains(string(body), "Users") {
			common.PrintVulnerabilityConfirmation("CVE-2018-1273", url, "存在漏洞,由于该漏洞无回显，请用Dnslog进行测试", "1")
			common.Vulnum++
			return
		} else {
			color.Yellow("[-] %s 未发现CVE-2018-1273远程命令执行漏洞\n", url)
			return
		}
	}

}
